@coreiam/auth 1.0.15 → 1.0.391

package/dist/nextjs/index.js

@@ -1,19 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NextHandlers = exports.coreIamMiddleware = exports.getSession = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.useAuth = exports.CoreIAMProvider = void 0;
+exports.OAuthHandlers = exports.NextHandlers = exports.verifyOtpActionSdk = exports.requestOtpActionSdk = exports.disableMfaActionSdk = exports.verifyMfaActionSdk = exports.setupMfaActionSdk = exports.updateProfileActionSdk = exports.logoutActionSdk = exports.registerActionSdk = exports.loginActionSdk = exports.getSession = exports.coreIamAuth = exports.coreIamMiddleware = exports.useAuth = exports.CoreIAMProvider = void 0;
+exports.auth = auth;
 // src/nextjs/index.ts
+const server_1 = require("next/server");
+const core_1 = require("../core");
 var provider_1 = require("./provider");
 Object.defineProperty(exports, "CoreIAMProvider", { enumerable: true, get: function () { return provider_1.CoreIAMProvider; } });
 Object.defineProperty(exports, "useAuth", { enumerable: true, get: function () { return provider_1.useAuth; } });
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "coreIamMiddleware", { enumerable: true, get: function () { return middleware_1.coreIamMiddleware; } });
+Object.defineProperty(exports, "coreIamAuth", { enumerable: true, get: function () { return middleware_1.coreIamAuth; } });
+// FIX: Export ALL Server Action functions here
 var actions_1 = require("./actions");
+Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
 Object.defineProperty(exports, "loginActionSdk", { enumerable: true, get: function () { return actions_1.loginActionSdk; } });
 Object.defineProperty(exports, "registerActionSdk", { enumerable: true, get: function () { return actions_1.registerActionSdk; } });
 Object.defineProperty(exports, "logoutActionSdk", { enumerable: true, get: function () { return actions_1.logoutActionSdk; } });
-Object.defineProperty(exports, "getSession", { enumerable: true, get: function () { return actions_1.getSession; } });
-var middleware_1 = require("./middleware");
-Object.defineProperty(exports, "coreIamMiddleware", { enumerable: true, get: function () { return middleware_1.coreIamMiddleware; } });
-const server_1 = require("next/server");
-const core_1 = require("../core");
+Object.defineProperty(exports, "updateProfileActionSdk", { enumerable: true, get: function () { return actions_1.updateProfileActionSdk; } });
+Object.defineProperty(exports, "setupMfaActionSdk", { enumerable: true, get: function () { return actions_1.setupMfaActionSdk; } });
+Object.defineProperty(exports, "verifyMfaActionSdk", { enumerable: true, get: function () { return actions_1.verifyMfaActionSdk; } });
+Object.defineProperty(exports, "disableMfaActionSdk", { enumerable: true, get: function () { return actions_1.disableMfaActionSdk; } });
+Object.defineProperty(exports, "requestOtpActionSdk", { enumerable: true, get: function () { return actions_1.requestOtpActionSdk; } });
+Object.defineProperty(exports, "verifyOtpActionSdk", { enumerable: true, get: function () { return actions_1.verifyOtpActionSdk; } });
 class NextHandlers {
     iam;
     constructor(iam) {
@@ -46,3 +55,84 @@ class NextHandlers {
     }
 }
 exports.NextHandlers = NextHandlers;
+class OAuthHandlers {
+    iam;
+    constructor(iam) {
+        this.iam = iam || new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: process.env.COREIAM_API_URL });
+    }
+    // Handles the initial redirect to Google/GitHub
+    async handleInitiate(req, provider) {
+        const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+        const response = await this.iam.proxy(`/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`, { method: 'GET' }, req.headers);
+        const data = await response.json();
+        if (data.url) {
+            return server_1.NextResponse.redirect(data.url);
+        }
+        return server_1.NextResponse.redirect(new URL('/auth/login', req.url));
+    }
+    // Handles the callback from Google/GitHub
+    async handleCallback(req, provider) {
+        const { searchParams } = new URL(req.url);
+        const code = searchParams.get('code');
+        const state = searchParams.get('state');
+        const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+        const targetUrl = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+        const response = await this.iam.proxy(targetUrl, { method: 'GET' }, req.headers);
+        const res = server_1.NextResponse.redirect(new URL('/', req.url));
+        const setCookies = response.headers.getSetCookie();
+        if (setCookies && setCookies.length > 0) {
+            setCookies.forEach(cookie => {
+                res.headers.append('set-cookie', cookie);
+            });
+        }
+        return res;
+    }
+}
+exports.OAuthHandlers = OAuthHandlers;
+const MAX_CACHE_SIZE = 10000;
+const apiKeyCache = new Map();
+async function auth(request) {
+    const authHeader = request.headers.get('authorization');
+    if (!authHeader?.startsWith('Bearer '))
+        return null;
+    const token = authHeader.substring(7);
+    const gatewayUrl = process.env.COREIAM_API_URL;
+    if (!gatewayUrl)
+        return null;
+    // 1. Check Cache
+    const cached = apiKeyCache.get(token);
+    if (cached && cached.expires > Date.now()) {
+        return cached.valid ? cached.identity : null;
+    }
+    // FIX: Prevent memory leak by clearing cache if it gets too large
+    if (apiKeyCache.size >= MAX_CACHE_SIZE) {
+        apiKeyCache.clear(); // Simple crude eviction. In production SDK, use lru-cache.
+    }
+    // 2. Call CoreIAM to verify
+    try {
+        const res = await fetch(`${gatewayUrl}/auth/api-keys/verify`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-API-Key': process.env.COREIAM_API_KEY
+            },
+            body: JSON.stringify({ token }),
+        });
+        const data = await res.json();
+        if (data.valid) {
+            const identity = {
+                sub: data.sub,
+                tenantId: data.tenantId,
+            };
+            apiKeyCache.set(token, { valid: true, identity, expires: Date.now() + (5 * 60 * 1000) });
+            return identity;
+        }
+        else {
+            apiKeyCache.set(token, { valid: false, expires: Date.now() + (5 * 60 * 1000) });
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+}

package/dist/nextjs/middleware.d.ts

@@ -1,9 +1,16 @@
 import { NextRequest, NextResponse } from 'next/server';
 /**
- * Handles CoreIAM token refresh and header rewriting.
- * Returns the NextResponse to return, and whether the user is authenticated.
+ * Helper function for custom middleware (proxy.ts).
+ * Returns the response and authentication state.
  */
-export declare function coreIamMiddleware(request: NextRequest): Promise<{
+export declare function coreIamAuth(request: NextRequest): Promise<{
     response: NextResponse;
     isAuthenticated: boolean;
 }>;
+/**
+ * 1-line middleware factory for developers who don't need custom routing.
+ */
+export declare function coreIamMiddleware(options?: {
+    publicRoutes?: string[];
+    signInUrl?: string;
+}): (request: NextRequest) => Promise<NextResponse<unknown>>;

package/dist/nextjs/middleware.js

@@ -1,11 +1,148 @@
 "use strict";
+// // src/nextjs/middleware.ts
+// import { NextRequest, NextResponse } from 'next/server';
+// import { jwtVerify, createRemoteJWKSet } from 'jose';
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreIamAuth = coreIamAuth;
 exports.coreIamMiddleware = coreIamMiddleware;
+// // FIX: Instantiate the JWKS client ONCE at the module level.
+// // This allows jose's internal cache to persist across requests.
+// const gatewayUrl = process.env.COREIAM_API_URL;
+// const JWKS = gatewayUrl 
+//   ? createRemoteJWKSet(new URL(`${gatewayUrl}/.well-known/jwks.json`))
+//   : null;
+// let refreshInFlight: Promise<{ jwt: string; refreshToken: string } | null> | null = null;
+// async function performRefresh(
+//   refreshTokenCookie: { value: string } | undefined,
+//   jwtCookie: { value: string } | undefined,
+//   gatewayUrl: string,
+// ): Promise<{ jwt: string; refreshToken: string } | null> {
+//   try {
+//     const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
+//       method: 'POST',
+//       headers: {
+//         'X-API-Key': process.env.COREIAM_API_KEY!,
+//         'cookie': `refreshToken=${refreshTokenCookie?.value || ''}; jwt=${jwtCookie?.value || ''}`,
+//       },
+//     });
+//     if (!refreshRes.ok) return null;
+//     const setCookies = refreshRes.headers.getSetCookie();
+//     let newJwt = '';
+//     let newRefreshToken = '';
+//     setCookies.forEach(cookie => {
+//       if (cookie.startsWith('jwt=')) newJwt = cookie.split(';')[0].split('=')[1];
+//       if (cookie.startsWith('refreshToken=')) newRefreshToken = cookie.split(';')[0].split('=')[1];
+//     });
+//     return newJwt ? { jwt: newJwt, refreshToken: newRefreshToken } : null;
+//   } catch (error) {
+//     return null;
+//   }
+// }
+// export async function coreIamMiddleware(request: NextRequest): Promise<{
+//   response: NextResponse;
+//   isAuthenticated: boolean;
+// }> {
+//   const jwtCookie = request.cookies.get("jwt");
+//   const refreshTokenCookie = request.cookies.get("refreshToken");
+//   let isAuthenticated = false;
+//   let needsRefresh = false;
+//   if (jwtCookie && JWKS) {
+//     try {
+//       // 1. SECURELY VERIFY JWT LOCALLY USING THE MODULE-LEVEL JWKS CLIENT
+//       const { payload } = await jwtVerify(jwtCookie.value, JWKS, {
+//         issuer: 'coreiam',
+//         algorithms: ['RS256']
+//       });
+//       // ATTACH IDENTITY TO REQUEST HEADERS FOR SERVER COMPONENTS
+//       const requestHeaders = new Headers(request.headers);
+//       requestHeaders.set('x-coreiam-identity', JSON.stringify({
+//         sub: payload.sub,
+//         email: payload.email,
+//         tenantId: payload.tenantId,
+//         roles: payload.roles || []
+//       }));
+//       const response = NextResponse.next({
+//         request: { headers: requestHeaders },
+//       });
+//       return { response, isAuthenticated: true };
+//     } catch (error: any) {
+//       // If token is expired, jose throws ERR_JWT_EXPIRED
+//       if (error.code === 'ERR_JWT_EXPIRED' && refreshTokenCookie) {
+//         needsRefresh = true;
+//       }
+//     }
+//   } else if (refreshTokenCookie) {
+//     needsRefresh = true;
+//   }
+//   if (needsRefresh && gatewayUrl) {
+//     if (!refreshInFlight) {
+//       refreshInFlight = performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl).finally(() => {
+//         refreshInFlight = null;
+//       });
+//     }
+//     const result = await refreshInFlight;
+//     if (result) {
+//       const requestHeaders = new Headers(request.headers);
+//       requestHeaders.set('cookie', `jwt=${result.jwt}; refreshToken=${result.refreshToken}`);
+//       requestHeaders.set('Authorization', `Bearer ${result.jwt}`);
+//       // ATTACH IDENTITY TO REQUEST HEADERS FOR SERVER COMPONENTS (using the new JWT)
+//       try {
+//         const payloadB64 = result.jwt.split('.')[1];
+//         const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
+//         const payload = JSON.parse(payloadStr);
+//         requestHeaders.set('x-coreiam-identity', JSON.stringify({
+//           sub: payload.sub,
+//           email: payload.email,
+//           tenantId: payload.tenantId,
+//           roles: payload.roles || []
+//         }));
+//       } catch {}
+//       const response = NextResponse.next({
+//         request: { headers: requestHeaders },
+//       });
+//       const isProd = process.env.NODE_ENV === 'production';
+//       response.cookies.set('jwt', result.jwt, {
+//         httpOnly: true,
+//         secure: isProd,
+//         sameSite: 'strict',
+//         maxAge: 24 * 60 * 60,
+//       });
+//       response.cookies.set('refreshToken', result.refreshToken, {
+//         httpOnly: true,
+//         secure: isProd,
+//         sameSite: 'strict',
+//         maxAge: 7 * 24 * 60 * 60,
+//       });
+//       return { response, isAuthenticated: true };
+//     }
+//     const response = NextResponse.next();
+//     response.cookies.delete('jwt');
+//     response.cookies.delete('refreshToken');
+//     return { response, isAuthenticated: false };
+//   }
+//   return { response: NextResponse.next(), isAuthenticated };
+// }
 // src/nextjs/middleware.ts
 const server_1 = require("next/server");
-const jwt_decode_1 = require("jwt-decode");
+//import { jwtVerify, createRemoteJWKSet } from 'jose';
+const core_1 = require("../core");
+const gatewayUrl = process.env.COREIAM_API_URL;
+/**
+const JWKS = gatewayUrl
+  ? createRemoteJWKSet(new URL(`${gatewayUrl}/.well-known/jwks.json`))
+  : null;
+*/
+let iam = null;
+function getIam() {
+    if (!gatewayUrl || !process.env.COREIAM_API_KEY)
+        return null;
+    iam ??= new core_1.CoreIAM({ apiKey: process.env.COREIAM_API_KEY, baseUrl: gatewayUrl });
+    return iam;
+}
 let refreshInFlight = null;
-async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
+async function performRefresh(refreshTokenCookie, jwtCookie) {
+    if (!gatewayUrl)
+        return null;
     try {
         const refreshRes = await fetch(`${gatewayUrl}/auth/refresh-token`, {
             method: 'POST',
@@ -17,8 +154,7 @@ async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
         if (!refreshRes.ok)
             return null;
         const setCookies = refreshRes.headers.getSetCookie();
-        let newJwt = '';
-        let newRefreshToken = '';
+        let newJwt = '', newRefreshToken = '';
         setCookies.forEach(cookie => {
             if (cookie.startsWith('jwt='))
                 newJwt = cookie.split(';')[0].split('=')[1];
@@ -32,37 +168,213 @@ async function performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl) {
     }
 }
 /**
- * Handles CoreIAM token refresh and header rewriting.
- * Returns the NextResponse to return, and whether the user is authenticated.
+ * Helper function for custom middleware (proxy.ts).
+ * Returns the response and authentication state.
  */
-async function coreIamMiddleware(request) {
+async function coreIamAuth(request) {
+    const { nextUrl, method } = request;
+    const pathname = nextUrl.pathname;
+    // ========================================
+    // 1. ZERO-CONFIG API PROXY
+    // ========================================
+    if (pathname.startsWith('/api/auth/')) {
+        // FIX: Short-circuit CORS Preflight requests!
+        if (method === 'OPTIONS') {
+            const res = new server_1.NextResponse(null, { status: 204 }); // 204 No Content
+            const origin = request.headers.get('origin');
+            if (origin) {
+                res.headers.set('Access-Control-Allow-Origin', origin);
+                res.headers.set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+                res.headers.set('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token');
+                res.headers.set('Access-Control-Allow-Credentials', 'true');
+            }
+            return { response: res, isAuthenticated: false };
+        }
+        //    const iam = new CoreIAM({ apiKey: process.env.COREIAM_API_KEY!, baseUrl: gatewayUrl! });
+        const iam = getIam();
+        if (!iam) {
+            return {
+                response: new server_1.NextResponse('CoreIAM is not configured (COREIAM_API_URL / COREIAM_API_KEY)', { status: 500 }),
+                isAuthenticated: false,
+            };
+        }
+        // FIX: Special handler for the Link Confirm POST! (Must be at the TOP, before generic body read)
+        if (pathname === '/api/auth/oauth/link/confirm') {
+            let formData = {};
+            const contentType = request.headers.get('content-type') || '';
+            if (contentType.includes('application/x-www-form-urlencoded')) {
+                const text = await request.text();
+                const params = new URLSearchParams(text);
+                formData = {
+                    tempToken: params.get('tempToken'),
+                    password: params.get('password')
+                };
+            }
+            else {
+                // Fallback to JSON (if called via fetch elsewhere)
+                formData = await request.json().catch(() => ({}));
+            }
+            const response = await iam.proxy('/auth/oauth/link/confirm', {
+                method: 'POST',
+                body: JSON.stringify(formData),
+                headers: { 'Content-Type': 'application/json' },
+            }, request.headers);
+            const data = await response.json().catch(() => ({}));
+            // If CoreIAM successfully verified the password and linked the account
+            if (response.ok && data.success) {
+                const appOrigin = request.nextUrl.origin; // e.g., http://localhost:3000
+                const redirectPath = data.redirectUri || '/';
+                const finalUrl = new URL(redirectPath, appOrigin).toString();
+                // FIX: Return a 200 OK with an HTML page that uses JavaScript to redirect.
+                // This breaks the cross-site redirect chain, forcing the browser to send the Lax cookies.
+                const html = `
+            <!DOCTYPE html>
+            <html>
+            <head>
+              <title>Linking Successful</title>
+            </head>
+            <body>
+              <p>Account linked successfully! Redirecting...</p>
+              <script>window.location.href = "${finalUrl}";</script>
+            </body>
+            </html>
+          `;
+                const res = new server_1.NextResponse(html, { status: 200, headers: { 'Content-Type': 'text/html' } });
+                // Set the cookies on the Next.js domain (localhost:3000)!
+                const isProd = process.env.NODE_ENV === 'production';
+                if (data.accessToken) {
+                    res.cookies.set('jwt', data.accessToken, { httpOnly: true, secure: isProd, sameSite: 'lax', maxAge: 24 * 60 * 60, path: '/' });
+                }
+                if (data.clientRefreshToken) {
+                    res.cookies.set('refreshToken', data.clientRefreshToken, { httpOnly: true, secure: isProd, sameSite: 'lax', maxAge: 7 * 24 * 60 * 60, path: '/' });
+                }
+                return { response: res, isAuthenticated: true };
+            }
+            // FIX: If it failed (wrong password), redirect back to the hosted page with an error param
+            const errorRedirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+            errorRedirect.searchParams.set('token', formData.tempToken);
+            errorRedirect.searchParams.set('provider', data.provider || 'google');
+            errorRedirect.searchParams.set('email', data.email || '');
+            errorRedirect.searchParams.set('appOrigin', request.nextUrl.origin);
+            errorRedirect.searchParams.set('error', data.message || 'Invalid password. Link failed.');
+            return { response: server_1.NextResponse.redirect(errorRedirect, 303), isAuthenticated: false };
+        }
+        // Now it is safe to read the body for all other standard routes (Login, Register, etc.)
+        let targetPath = pathname.replace('/api/auth', '/auth');
+        const body = method !== 'GET' ? await request.json().catch(() => undefined) : undefined;
+        // FIX: Special routing for OAuth Initiate
+        if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
+            const provider = pathname.split('/').pop();
+            const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+            targetPath = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
+        }
+        // FIX: Special routing for OAuth Callback
+        if (pathname.startsWith('/api/auth/callback/')) {
+            const provider = pathname.split('/').pop();
+            const searchParams = new URL(request.url).searchParams;
+            const code = searchParams.get('code');
+            const state = searchParams.get('state');
+            const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/callback/${provider}`;
+            targetPath = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${redirectUri}`;
+        }
+        const response = await iam.proxy(targetPath, {
+            method,
+            body: body ? JSON.stringify(body) : undefined,
+            headers: { 'Content-Type': 'application/json' },
+        }, request.headers);
+        // Handle OAuth Initiate Redirects
+        if (pathname.startsWith('/api/auth/oauth/') && !pathname.includes('callback') && !pathname.includes('link')) {
+            const data = await response.json().catch(() => ({}));
+            if (data.url)
+                return { response: server_1.NextResponse.redirect(data.url), isAuthenticated: false };
+            return { response: server_1.NextResponse.redirect(new URL('/auth/login', request.url)), isAuthenticated: false };
+        }
+        // Handle OAuth Callback Redirects
+        if (pathname.startsWith('/api/auth/callback/')) {
+            const data = await response.json().catch(() => ({}));
+            // FIX: Redirect to CoreIAM's Hosted Confirmation Page and pass appOrigin!
+            if (data.action === 'link_candidate') {
+                const appOrigin = request.nextUrl.origin; // e.g., http://localhost:3000
+                const redirectUrl = `${gatewayUrl}/auth/hosted/confirm-link?token=${encodeURIComponent(data.tempToken)}&provider=${encodeURIComponent(data.provider)}&email=${encodeURIComponent(data.email)}&appOrigin=${encodeURIComponent(appOrigin)}`;
+                return { response: server_1.NextResponse.redirect(redirectUrl), isAuthenticated: false };
+            }
+            // Normal OAuth login: redirect to dashboard
+            const res = server_1.NextResponse.redirect(new URL('/', request.url));
+            const setCookies = response.headers.getSetCookie();
+            setCookies.forEach(c => res.headers.append('set-cookie', c));
+            return { response: res, isAuthenticated: false };
+        }
+        // Standard JSON API Responses (Login, Logout, Register, etc.)
+        const data = await response.json().catch(() => ({}));
+        const res = server_1.NextResponse.json(data, { status: response.status });
+        const setCookies = response.headers.getSetCookie();
+        setCookies.forEach(c => res.headers.append('set-cookie', c));
+        return { response: res, isAuthenticated: false };
+    }
+    /**
+      // 2. LOCAL JWT VERIFICATION & REFRESH
+      const jwtCookie = request.cookies.get("jwt");
+      const refreshTokenCookie = request.cookies.get("refreshToken");
+    
+      let isAuthenticated = false;
+      let needsRefresh = false;
+    
+      if (jwtCookie && JWKS) {
+        try {
+          const { payload } = await jwtVerify(jwtCookie.value, JWKS, {
+            issuer: 'coreiam',
+            algorithms: ['RS256']
+          });
+          
+          const requestHeaders = new Headers(request.headers);
+          requestHeaders.set('x-coreiam-identity', JSON.stringify({
+            sub: payload.sub,
+            email: payload.email,
+            tenantId: payload.tenantId,
+            roles: payload.roles || []
+          }));
+          
+          return {
+            response: NextResponse.next({ request: { headers: requestHeaders } }),
+            isAuthenticated: true
+          };
+        } catch (error: any) {
+          if (error.code === 'ERR_JWT_EXPIRED' && refreshTokenCookie) {
+            needsRefresh = true;
+          }
+        }
+      } else if (refreshTokenCookie) {
+        needsRefresh = true;
+      }
+    
+    */
+    // 2. LOCAL JWT VERIFICATION & REFRESH
+    //    Now delegates to CoreIAM.verifySession — the same code path Express
+    //    users get, so the two implementations can never drift.
     const jwtCookie = request.cookies.get("jwt");
     const refreshTokenCookie = request.cookies.get("refreshToken");
-    const gatewayUrl = process.env.COREIAM_API_URL;
-    let isAuthenticated = false;
+    const client = getIam();
     let needsRefresh = false;
-    if (jwtCookie) {
-        try {
-            const decoded = (0, jwt_decode_1.jwtDecode)(jwtCookie.value);
-            if (decoded.exp && decoded.exp * 1000 > Date.now()) {
-                isAuthenticated = true;
-            }
-            else if (refreshTokenCookie) {
-                needsRefresh = true;
-            }
+    if (client) {
+        const result = await client.verifySession(request.headers);
+        if (result.identity) {
+            const requestHeaders = new Headers(request.headers);
+            requestHeaders.set('x-coreiam-identity', JSON.stringify(result.identity));
+            return {
+                response: server_1.NextResponse.next({ request: { headers: requestHeaders } }),
+                isAuthenticated: true
+            };
         }
-        catch {
-            if (refreshTokenCookie)
-                needsRefresh = true;
+        if (refreshTokenCookie && (result.reason === 'expired' || result.reason === 'no_cookie')) {
+            needsRefresh = true;
         }
     }
     else if (refreshTokenCookie) {
         needsRefresh = true;
     }
-    // 1. ATTEMPT SILENT REFRESH (single-flight)
-    if (needsRefresh && gatewayUrl) {
+    if (needsRefresh) {
         if (!refreshInFlight) {
-            refreshInFlight = performRefresh(refreshTokenCookie, jwtCookie, gatewayUrl).finally(() => {
+            refreshInFlight = performRefresh(refreshTokenCookie, jwtCookie).finally(() => {
                 refreshInFlight = null;
             });
         }
@@ -71,30 +383,48 @@ async function coreIamMiddleware(request) {
             const requestHeaders = new Headers(request.headers);
             requestHeaders.set('cookie', `jwt=${result.jwt}; refreshToken=${result.refreshToken}`);
             requestHeaders.set('Authorization', `Bearer ${result.jwt}`);
-            const response = server_1.NextResponse.next({
-                request: { headers: requestHeaders },
-            });
+            try {
+                const payloadB64 = result.jwt.split('.')[1];
+                const payloadStr = Buffer.from(payloadB64, 'base64').toString('utf8');
+                const payload = JSON.parse(payloadStr);
+                requestHeaders.set('x-coreiam-identity', JSON.stringify({
+                    sub: payload.sub,
+                    email: payload.email,
+                    tenantId: payload.tenantId,
+                    roles: payload.roles || []
+                }));
+            }
+            catch { }
+            const response = server_1.NextResponse.next({ request: { headers: requestHeaders } });
             const isProd = process.env.NODE_ENV === 'production';
-            response.cookies.set('jwt', result.jwt, {
-                httpOnly: true,
-                secure: isProd,
-                sameSite: 'strict',
-                maxAge: 24 * 60 * 60,
-            });
-            response.cookies.set('refreshToken', result.refreshToken, {
-                httpOnly: true,
-                secure: isProd,
-                sameSite: 'strict',
-                maxAge: 7 * 24 * 60 * 60,
-            });
+            response.cookies.set('jwt', result.jwt, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 24 * 60 * 60 });
+            response.cookies.set('refreshToken', result.refreshToken, { httpOnly: true, secure: isProd, sameSite: 'strict', maxAge: 7 * 24 * 60 * 60 });
             return { response, isAuthenticated: true };
         }
-        // 2. IF REFRESH FAILED, CLEAR COOKIES
         const response = server_1.NextResponse.next();
         response.cookies.delete('jwt');
         response.cookies.delete('refreshToken');
         return { response, isAuthenticated: false };
     }
-    // 3. NO REFRESH NEEDED (Token is valid or completely missing)
-    return { response: server_1.NextResponse.next(), isAuthenticated };
+    return { response: server_1.NextResponse.next(), isAuthenticated: false };
+}
+/**
+ * 1-line middleware factory for developers who don't need custom routing.
+ */
+function coreIamMiddleware(options = {}) {
+    const { publicRoutes = [], signInUrl = '/login' } = options;
+    return async (request) => {
+        const { response, isAuthenticated } = await coreIamAuth(request);
+        const pathname = request.nextUrl.pathname;
+        const isPublicRoute = publicRoutes.some(route => pathname.startsWith(route));
+        // If not authenticated and trying to access a protected route
+        if (!isAuthenticated && !isPublicRoute) {
+            const redirect = server_1.NextResponse.redirect(new URL(signInUrl, request.url));
+            // CRITICAL: Copy any refreshed cookies/headers from the SDK response onto the redirect
+            const setCookies = response.headers.getSetCookie();
+            setCookies.forEach(c => redirect.headers.append('set-cookie', c));
+            return redirect;
+        }
+        return response;
+    };
 }

package/dist/nextjs/provider.d.ts

@@ -1,39 +1,30 @@
 import React from 'react';
 import type { CoreIAMIdentity } from '../core';
-export interface CoreIAMRedirects {
-    /** Where to send the user after a successful login, if no callbackUrl is passed to login(). */
-    afterLogin?: string;
-    /** Where to send the user after logout. */
-    afterLogout?: string;
-}
-interface LoginResult {
-    success?: boolean;
-    error?: string;
-}
 interface AuthContextType {
-    /**
-     * Generic CoreIAM identity (sub/email/roles/tenantId) — NOT an app-shaped
-     * user. This SDK has no knowledge of any consumer's local user model
-     * (roles, profile fields, etc). Consumers that need an enriched user
-     * object should build their own layer on top of this, keyed off `sub`.
-     */
     identity: CoreIAMIdentity | null;
     isLoading: boolean;
     isAuthenticated: boolean;
     login: (values: {
         email: string;
         password: string;
-    }, callbackUrl?: string) => Promise<LoginResult>;
+    }, callbackUrl?: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
     logout: () => Promise<void>;
-    register: (userData: Record<string, any>) => Promise<LoginResult>;
+    register: (userData: any) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
+    verifyMfa: (tempToken: string, code: string) => Promise<{
+        success?: boolean;
+        error?: string;
+    }>;
     refetchIdentity: () => Promise<void>;
 }
-export declare function CoreIAMProvider({ children, initialIdentity, redirects, }: {
+export declare function CoreIAMProvider({ children, initialIdentity }: {
     children: React.ReactNode;
-    /** Pass the result of a server-side getSession() call to skip the client fetch on first paint. */
     initialIdentity?: CoreIAMIdentity | null;
-    /** Where to redirect after login/logout. Omit for no redirect (caller handles navigation itself). */
-    redirects?: CoreIAMRedirects;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function useAuth(): AuthContextType;
 export {};